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TITLE 



MODULAR MULTIPLIER AND AN ENCRYPTION/DECRYPTION PROCESSOR 
USING THE MODULAR MULTIPLIER 

5 

BACKGROUND OF THE INVENTION 



Field of the Invention: 

This invention relates to a modular multiplier 
10 operation structure, particularly to a modular multiplier 
realized by the high-radix Montgomery operation algorithm. 



Description of the Related Art: 

III Due to the requirements of data transfer in networking 

15 and digitization, the cryptography for the data security 
mechanism has spurred efforts to the design. The basic 
principle of the cryptography is that a plaintext is 
converted into a ciphertext through a encryption and a 
encryption key chosen by a user. When a receiver receives 

20 the ciphertext, a decryption with respect to the encryption 
and a respective decrypt ion key of the encryption key can 
recover the plaintext. Because the data in transfer or 
storage is in the ciphertext, the data security is achieved 
since an adversary has no the decryption key to get the 

25 transfer data. 

The security of a cryptosystems is built on the basis of 
the potential of extracting the keys. The security of the 
cryptosystem is indicated by the potential of extracting the 
keys from the existing data. Current cryptosystem is 

30 divided into two types, private key cryptosystem and public 
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key cryptosystem. In private key cryptosystem, encryption 
and decryption keys are the same, for example, the widely 
used system is the DES system. The same encryption and 
decryption keys mean that the keys must be stored in an 
absolutely secure transmission path to ensure the transfer 
security. This is the main drawback in private key 
crytosystem. There is no such a problem in public key 
cryptosystem. In public key cryptosystem, encryption and 
decryption keys are different. In a pair of encryption and 
decryption keys, encryption key is a public key. When the 
plaintext is encrypted by encryption key into the 
ciphertext, only the respective decryption key of encryption 
key can recover it. Also, such a system, e.g. Rivest, 
Shamir, Adleman (RSA) , must offer the guaranty that the 
respective decryption can not or hardly be extracted without 
telling it. Accordingly, public key cryptosystem becomes 
increasingly and leads the world trend in the cryptosystem 
because besides it has not the key transfer and management 
problem, the descryption key in public key cryptosystem 
offers the function of certifying a digital signature. 

RSA cryptosystem uses the modular exponentiation 
operation to generate the encrypt ion/ decrypt ion function. 
The encryption/decryption is expressed as follows: 

C=M E (mod N) (l) 

M=C D (mod N) (2) 
where N=PQ and ED 1 mod (P-l) (Q-l) , M is plaintext; C is 
ciphertext; E is encryption key; and D is decryption key. 

N is the product of two prime numbers P and Q. Equation 
(1) represents the encryption action. The modular 

multiplication operation (E, N) is used to convert the 
plaintext M into the ciphertext C. Equation (2) represents 
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the decryption action. The 'modular multiplication operation 
(D, N) is used to recover the plaintext M from the 
ciphertext C. In RSA cryptosystem, the modular 

exponentiation operation is complex and takes much time in 
5 computation. Hence, the modular multiplier is commonly used 
to realize the modular exponentiation operation, especially 
to the utilization of Montgomery algorithm. For example, 
the Montgomery algorithm is used in the basic operation of 
AB (mod N) as the following algorithm 1: 
10 <Algorithm 1> 

R 0 =0; 

For i=0 to n-1 do 

qi=Ri+aiB (mod 2) (3) 
Ri+i= (Ri+aiB+qiN) /2 (4) 

*5 end 

where A=a n -i2 n " 1 +a n . 2 2 n " 2 + +a 0 ; B=b n -i2 n " 1 +b n . 2 2 n " 2 + +b 0 ; and 

ai,bi,qie{0, l}. 

The foregoing algorithm performs a n-time loop with an 
n-bit adder and a lxn multiplier. The performed result for 

20 every loop is respectively multiplied by 2°, 2 L , 2 2 , , 2 n_1 

and then summed total. The final total summed is expressed 
as follows: 

2 n R n = AB (mod N) (5) 

According to equation (5), R n is expressed as follows: 
25 R n = 2" n AB (mod N) (6) 

Therefore, the modular exponentiation operation of 
equation (1) or (2) is performed by Montgomery algorithm 
according to the following pre-operat ion, exponentiation 
operation, and post -operation : 
30 MGM ( M , 2 2n ) = 2 n M (mod N) (7) 

MGM ( 2 n M a , 2 n M b ) = 2 n M a+b (mod N) (8) 
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MGM (2 n M E , 1) = M E (mod N) ' ' (9) 

where MGM(»,») represents the operand R n executed by 
Montgomery algorithm, i.e., the result from equation (6) R n 
= 2~ n AB (mod N) . 

5 Because the need of performing n-time loop in algorithm 

1 takes time in the computation, the chip area in the high 
radix (2 k ) Montgomery algorithm is adopted to efficiently 
increase the operation speed. The high radix Montgomery 
algorithm reduces the modular multiplication from one to n/k 
10 by dividing the operand A into [n/k] groups, each group 
having k bits, when decoding or encoding data, thereby 
s g achieving the purpose of increasing the speed. The 

If algorithm is expressed as follows: 

m <Algorithm 2> 

15 Ro = 0; 

For i=0 to [n/k] -1 do 

q±= (Ri+aiB) *N X (mod 2 k ) (10) 
Ri+i= (Ri+aiB+qiN) /2 k (11) 

111 end 

20 where N x is satisfied with N*Ni = -l(mod 2 k ) , A=ar n /kl-i (2 k ) rn/k1 ~ 

1 +ar n /kl- 2 (2 k ) rn/k1 ~ 2 + + a 0 ; and a±, q±G{0, 1, 2, , 2 k_1 }, for k 

>0 . 

Although the loop in algorithm 2 is reduced, a further 
reduction for the loop is subjected to algorithm 3, which 
25 shifts the operand B by k bits and changes the parameter N 
into N 2 in order to eliminate the multiplication and 
addition operations in equation (10) . The expression is: 

<Algorithm 3> 

R 0 =0; 

30 For i = 0 to Tn/kl do 

qi=Ri(mod 2 k ) (12) 
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Ri + i= (Ri+qi*N 2 ) /2 k +aiB ' (13) 

end 

where N 2 = mN = -1 (mod 2 k ) . 

Likewise, the result for every loop is respectively 

5 multiplied by 2°, 2 1 , 2 2 , , 2 n_1 and then summed total. The 

final total is expressed as follows: 

2 n+k RTn/k] + i A*2 k *B+Q*N 2 (14) 

Accordingly, the relationship derived from equation (5) 
is satisfied as a result of R (n /k)+i and that is: 
10 2 n RT n/k l +1 AB (mod N) (15) 

"f The best advantage in algorithm 3 is the same operation 

structure as mentioned above, i.e., only a multiplication 
\n and addition is executed for the operand R i+ i in equation 

:: (13). 

; ; 15 Assume that X= Ri + qi*N 2 (16) 

Then equation (13) is modified as the following equation: 
R i+1 =X/2 k +ai*B (17) 
|U if Y=X/2 k , equation (17) is changed as the following 

; ■■ equation: 

5 2D R i+ i=Y+ai*B (18) 

Equations (17) and (18) are respectively executed a 
multiplication and addition operations and the corresponding 
operands have the same bit number. Therefore, a same data 
path is used in the computation operation at different time 

25 points, thereby saving the area required for a chip. 

However, Montgomery algorithm 3 also has the complex 
computation problem when the required area for the 
multiplication is broad. In equations (16) and (18) , a kxn 
multiplier is used. If the values n and k are large, for 

30 example, k=32 and n=1024, the chip area therefore becomes 
very broad. For a chip with the strict request of small 
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size, e.g. a Smart Card,' this will influence on its 
operation and application. As to this point, the invention 
provides a solution by improving the high radix Montgomery 
algorithm to reduce the chip area and have the high-speed 
5 operation. 

SUMMARY OF THE INVENTION 

Accordingly, the object of the invention is to provide a 
modular multiplier and an encryption/decryption processor 

10 using the modular multiplier, capable of reducing the chip 
O area and achieving the purpose of high-speed operation. 

To realize the above and other objects, the invention 
provides a modular multiplier, capable of processing a first 
operand and a second operand in relation to a modulus for 
j |5 performing the modular multiplication operation. The 
performed operation includes an instruction, which has an 
internal multiplication and addition operation with inner 
recursion and an external multiplication and addition 
operation. The modular multiplier includes a first buffer 

20 device for storing the first operand, the first operand is 
divided into a first plurality of sub-operands with fixed 
length; a second buffer device for storing the second 
operand, the second operand is divided into a second 
plurality of sub-operands with fixed length; a third buffer 

25 device for storing the parameter of the modular 
multiplication operation; a multiplexer device, coupled to 
the first, the second, and the third buffer devices, for 
choosing a first multiplication operand and a second 
multiplication operand from the first sub-operand, the 

30 second sub-operand, and the parameter in order according to 
the required internal and external multiplication/ addition 
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operations; a multiplication 'device, coupled to the 
multiplexer device, for multiplying the first multiplication 
operand by the second multiplication operand to obtain a 
product; and an addition device, coupled to the 
5 multiplication device, for outputting an intermediate result 
according to the product during the internal multiplication 
and addition operation and outputting the result of the 
modular multiplication operation according to the product 
and the intermediate result during the external 

10 multiplication and addition operation. 

The modular multiplier can be an encryption or 
decryption processor, for example, RSA cryption processor, 
jj; The encryption or decryption processor performs the modular 

exponentiation operation in the encryption/decryption 

15 function according to the encrypt ion/ decrypt ion key, thereby 
realizing the modular multiplier. The encrypt ion/ decrypt ion 
processor can be applied to, such as, a Smart Card, 
especially to a modular multiplier having the needs of 
requiring a small chip area and higher operating speed. 

20 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a block diagram illustrating a modular 

multiplier of an embodiment of the invention; 

Fig. 2 is a schematic diagram illustrating an adder to 

25 be operated in the first sub- loop according to the 

embodiment of the invention; 

Fig. 3 is a schematic diagram illustrating an adder to 

be operated in the second sub-loop according to the 

embodiment of the invention; 
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Fig. 4 is a block 'diagram illustrating an RSA 
encryption/decryption processor realized by the modular 
multiplier of Fig. 1; 

Fig. 5 is a schematic diagram illustrating the 
5 application of Fig. 4 in a Smart Card according to the 
embodiment of the invention. 

DETAILED DESCRIPTION OF THE INVENTION 

This invention provides a solution for reducing the chip 
10 area in the prior art. That is, in the prior art, algorithm 
3 needs very broad chip area to implement a kxn multiplier. 
The following embodiment describes the inventive algorithm 
|lf; first and the modular multiplier structure in relation to 

the algorithm later. 
15 In order to reduce the required chip area, the n-bit 

portion (i.e. the operand N 2 in equation (16) and the 
operand B in equation (18)) in algorithm 3 is grouped to 
Tn/kl groups, each group having k bits. That is, 
<Algorithm 4> 
20 R 0 = 0; 

For i = 0 to Tn/k] do 

qi=Ri(mod 2 k ) (19) 
For j=0 to fn/kl-1 do 

(Ri + i)j=((Ri)j +qi*(N 2 ) j )/2 k +a i B j (2 0) 

25 end 
end 

where qi*(N 2 )j and aiBj respectively are the kxk 
multiplication operation. 
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In algorithm 4, although the loop j needs extra carry 
and accumulation operations, the chip area is reduced 
obviously from kxn to kxk. 

The algorithm 4 is further embodied in following 
algorithm 5 : 

<Algorithm 5> 

R 0 =0 ; 

For i=0 to Tn/k] do 

qi=Ri mod 2 k (21) 
W=gi*(N 2 ) 0 (22) 
C-i=(Ri) 0 + W[ (k-1) :0] (23) 
V=0 (24) 
For j=0 to Tn/kl-1 do 

Z=W (25) 
W= qi *(M 2 ) j+1 (26) 
U=ai*Bj (27) 
{Cj, (R i+1 ) j}= (Ri) j+1 +W[ (k-1) :0] +Z [ (2k-l) :k] +U[ (k- 
1) :0] +V[ (2k-l) :k] +C j _ 1 (28) 
V=U (29) 
end 

end 

where W, Z, U, V are temporary buffers, C. lf Cj are carry 
bits, and {Cj , (R i+1 ) } is the total of k-bit addition. More, 
(Ri)o + W[(k-1) :0] can become zero (i.e. C_i=0) if choosing 
appropriate q ir N 2 . 

In algorithm 5, two kxk multipliers are used to 
respectively calculate the operand W in equation (26) and 
the operand U in equation (27) . In fact, algorithm 5 can 
further uses two sub-loop operations in loop j as following 
equation 6. 

<Algorithm 6> 
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R 0 =0; 

For i=o to Tn/kl do 

qi=Ri(mod 2 k ) (30) 
For j=0 to Tn/kl-1 do 

Yj=( (Ri) j + qi * (N 2 ) j)/2 k (31) 

end 

For j=0 to Tn/kl-l do 

(R i+1 ) j =Y j +a i *B j (32) 

end 

end 

Likewise, algorithm 6 is further embodied in 
following algorithm 7: 
<Algorithm 7> 
R 0 =0; 

For i=0 to Tn/kl do 

q±=Ri mod 2 k (33) 
W=qi*(N 2 ) 0 (34) 
C-i= (Ri) o + W[ (k-1) : 0] (35) 
For j=0 to Tn/kl-1 do 

Z=W (36) 
W= qi *(N 2 ) j+1 (37) 
{C j ,Y j }=(R i ) j+1+ W[ (k-1) :0]+Z[(2k-l) :k] +C j . 1 

(38) 

C-i = 0 (39) 
Z=0 (40) 
end 

For j=0 to Tn/k]-l do 

W=ai*Bj (41) 
{Cj, (R i+1 ) j}=Y j+ W[ (k-1) :0]+Z[(2k-l) ikl+Cj-! 

(42) 
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Z=W ' (43) 

end 

end 

In algorithm 6 and 7, the loop j in algorithm 5 is 
divided into two sub-loops. This manner can reduce the 
requirement of two kxk multipliers to only one kxk 
multiplier, thereby shrinking the required chip area. 
Besides, the performance is even faster. For example, when 
n=1024, k=32, and a clock requirement to a 32x32 
multiplication is assumed, executing the first sub-loop j in 
equation (31) needs (1024/32) =32 clocks and the same clocks 
as performing the second sub-loop j in equation (32) . The 
entire multiplication operation (i.e. loop i) takes 
(1024/32+l)x(32+32) =2112 clocks. If the H-Algorithm is used 
in the 1024 -bit RSA encode or decode modular exponentiation 
operation, the entire circuit takes about 2x2112x1024 
clocks (about 4M clocks), i.e., 4n 2 (n+l)/k 2 in terms of 
parameters n and k. Thus, the purposes of smaller chip area 
and faster operation are achieved at the same time. 

Fig. 1 is a block diagram illustrating a modular 
multiplier of equation 6 or 7 . The modular multiplier 
structure in Fig. 1 is implemented according to algorithm 7, 
including buffers 101, 102, 103, 104, 105; multiplexers 201, 
202; multiplier 203; control unit 204; flip/flops 301, 302, 
303, 305, 306; and adder 304. Each element is described as 
follows . 

Buffer 101 is used to store Montgomery algorithm's 
result (R i+ i) j or the intermediate operand Yj in the first 
sub-loop. Buffers 102-105 are used to respectively store 
the operands A, N 2 , B, q ± of the two multiplication 
equations (equations (37) and (41)) in algorithm 7, wherein 
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operands A, N 2 , B are a constant,' ai is a portion of bits of 
the operand A in i th loop, (N 2 ) j and Bj are a portion of bits 
of operands N 2 and B in j th loop. According to equation 
(33) , qi stored in buffer 105 is the remainder from Ri/2 k , 
that is, from bit (k-1) to bit 0 in R± . Hence, the lower k 
bits of R ± stored in buffer 101 are extracted to have the 
operand q± in buffer 105. 

Multiplexers 201 and 202 are used to switch the required 
operands in the multiplication operation of different loop. 
For example, a multiplication operation is required for q t 
and (N 2 )j in equation (37) of the first sub-loop, while a 
multiplication operation is required for ai and Bj in 
equation (41) of the second sub-loop. Multiplexers 201 and 
2 02 are switched by the control signal CTRL of the control 
unit 204. A multiplication operation is performed by the 
kxk multiplier 203 with the outputs of 201 and 202 to create 
the product stored in buffer W with the length 2k. 

Flip/flops 301-303 are used to store the result from the 
multiplier and output the result to the adder 3 04 to execute 
the addition operation in equations (38) and (42) . Buffer W 
with the length 2k is divided into two k-length data, 
wherein the data in low bits W[(k-1):0] is outputted to 
flip/flop 302, the data in high bits W[(2k-l):k] is 
outputted to flip/flop 301. Flip/flop 303 stores the high 
bits Z[(2k-l):k] of the previous multiplication result. 
Flip/flop 305 stores the carry bit Cj_i of the previous 
addition result. Adder 304 performs the addition operation 
in equation (38) of the first sub-loop or in equation (42) 
of the second sub-loop. The difference between equations 
(38) and (42) for the addition operation is the operand, 
using (Ri) j+ i or Yj . When performing the first loop, 
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flip/flop 306 stores the operand Yj while when performing 
the second loop, flip/flop 306 stores the operand (Ri)j + i, 
and the two operands Yj and (Ri) j+1 are stored in buffer 101 
temporarily. 

The operation of the modular multiplier shown in Fig. 1 
is described in detail as follows. 

According to algorithm 7, the first instruction for 
every i loop begins with the calculation of the remainder of 
Ri/2 k , that is, taking lower k bits of the operand R± in 
buffer 101 into buffer 105. 

The operation starts the first sub- loop, which 
calculates Yj with the parameters q iy (N 2 )j, and (Rj.) j . 
First, in the 1 st sub-loop, the parameter q ± in the ith loop 
is unchanged and comes from buffer 105 for the calculation. 
Buffer 103 outputs the corresponding (N 2 )j depending on the 
value j . The higher k bits W[(2k-l):k] and lower k bits 
W[(k-1):0] of the product for every multiplication operation 
in the multiplier 203 are inputted to flip/flops 301 and 
302, respectively. Inputting the higher k bits to flip/flop 
301 is performed by a clock delay. Therefore, the performed 
result is counted into Y j+1 for the addition calculation. 
The value Yj is calculated by the adder 304 to add together 
with the lower k bits W[(k-l).-o], the higher k bits Z [ (2k- 
1) :k] (stored in flip/flop 303) of previous product, (R ± ) j+1 
(stored in buffer 101) , and the overflow bit Cj_i of previous 
addition operation (stored in flip/flop 3 05) . The calculated 
result from the adder 3 04 is stored in buffer 101 at next 
clock. 

Fig. 2 is a schematic diagram illustrating an adder to 
be operated in the first sub-loop according to the 
embodiment of the invention. Assume that k=32 and n=1024, 
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the first column representing the calculation of equation 
(35). When j=0, the adder 304 adds up R ± [63:32], 

(qi<N 2 )i) [31:0] , (qi(N 2 ) 0 ) [63:32] , and the carry bit Cj-! and 
gets Y[31:0]. When j=l, the adder 304 adds up R ± [95:64], 
(qi(N 2 ) 2 ) [31:0] , (qi (N 2 ) x ) [63 : 32] , and the carry bit C 0 and 
gets Y[63:32]. The remaining operations for j=2 to 31 are 
all similar. That is, when j=31, Y [1023: 992] is found, and 
Y [1023:0] is completed. 

Thus, the second sub- loop sequentially starts at the 
calculation of (R i+1 )j with the parameters a it Bj , Yj . 
Likewise, the parameter a*, in the i th loop is unchanged and 
comes from buffer 102 for the calculation. Buffer 104 
outputs the corresponding Bj depending on the value j . The 
higher k bits W[(2k-1) :k] and lower k bits W[(k-1) :0] of the 
product for every multiplication operation in the multiplier 
203 are inputted to flip/flops 301 and 302, respectively. 
Inputting the higher k bits to flip/flop 3 01 is performed by 
a clock delay. Therefore, the performed result is counted 
into (Ri+i) j+ i for the addition calculation. The value (R i+ i)j 
is calculated by the adder 3 04 to add up the lower k bits 
W[(k-i) : o], the higher k bits Z [ (2k-l) :k] (stored in 
flip/flop 303) of previous product, Yj (stored in buffer 
101) , and the carry bit Cj^ of previous addition 
operation (stored in flip/flop 305). The calculated result 
from the adder 304 is stored in buffer 101 at next clock. 

Fig. 3 is a schematic diagram illustrating an adder to 
be operated in the second sub- loop according to the 
embodiment of the invention with reference to Fig. 2. When 
j=0, the adder 304 adds up Y[31:0], (a i B 1 )[31:0] and 
(aiB 0 ) [63 :32] , and gets R i+1 [63:32], The remaining 
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operations for j =1 to 31 are all similar. That is, when 
j=31, R i+1 [1023 : 992] is found, and R i+1 [1023:0] is completed. 

Thus, repeated the calculation of Ri for every i and the 
final result of the Montgomery algorithm is found, which is 
the modular multiplication of 2~ n AB(mod N) . It is noted 
that the intermediate content of corresponding flip/flops 
between the first and second sub-loops is clear in order to 
use the same data path to calculate different equations. 
The control unit 204 is used to control the entire operation 
by a control signal CTRL. The required calculation for the 
final result of equation 6 or 7 is performed by orderly 
shifting different multiplication operands into the 
multiplier . 

The advantage of the invention is that the inventive 
modular multiplier can save the chip area and quickly 
perform the operation concurrently. Fig. 4 is a block 
diagram illustrating an RSA encryption/decryption processor 
realized by the modular multiplier of Fig. 1. As shown in 
Fig. 4, the RSA encryption/decryption processor includes an 
encrypt ion/ decrypt ion core 12 and a modular multiplier core 
14. The modular multiplier core 14 can be realized by, for 
example, the structure of Fig. 1. The modular 

multiplication result is calculated with the operands A and 
B. The encrypt ion/decrypt ion core 12 performs the required 
modular exponentiation operation to encrypt a plaintext to a 
ciphertext or decrypt the ciphertext to the plaintext using 
the steps of pre-operation in equation (7) , exponentiation 
operation in equation (8) and post -operation in equation 
(9) . 

Fig- 5 is a schematic diagram illustrating the 
encryption/decryption structure applied to a Smart Card 
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according to the embodiment of the invention. Due to the 
limits to Smart Card's standard and its facility in carry, 
the strict chip area is a must. As shown in Fig. 5, the 
Smart Card 2 0 exchanges the external data through a 
5 communication interface 22. Before the data transfer, the 
data is encrypted by the encrypt ion/de crypt ion processor 24 
through the internal memory 26 of the Smart Card 20 to 
ensure the data security. Because the need of finishing the 
required calculation as soon as possible by using the 

10 encryption/decryption processor 24 with a smaller area in a 
chip, the multiplier structure of the invention is the best 
choice to reach the goal. 

Although the present invention has been described in 
its preferred embodiment, it is not intended to limit the 

15 invention to the precise embodiment disclosed herein. Those 
who are skilled in this technology can still make various 
alterations and modifications without departing from the 
scope and spirit of this invention. Therefore, the scope of 
the present invention shall be defined and protected by the 

20 following claims and their equivalents. 
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